Privacy notice / Privacyverklaring
Staging notice and proposed production version — 15 October 2026. The details below identify the operator. Final supplier agreements and production retention settings require confirmation before production use with real player data.
Who is responsible
- Registered business / onderneming
- InForm Ventures
- Registered trade name / handelsnaam
- InForm Rugby
- KVK
- 42152144
- VAT identification / btw-id
- NL005536407B49
- support@informrugby.com
- Business and correspondence address
- Santhorstlaan 48, Wassenaar
Sign in to view the telephone number
InForm Ventures controls personal data used for its accounts, security, subscriptions, enquiries and coaching appointments. For player and match information entered on a club’s or analyst’s instructions, that organisation determines the purpose and permitted users; we act as processor where the applicable arrangement requires it. Contact the club about its lawful basis, recording permissions and notices. We assist with requests involving our service. We have not appointed a statutory data protection officer; use the contact email above for privacy questions.
What we use, why, and on what basis
| Information | Purpose and legal basis |
|---|---|
| Name, email, Auth0 identity reference, account and organisation membership | Sign-in, access and account support: steps towards or performance of a contract (GDPR 6(1)(b)); secure access and preventing misuse: legitimate interests (6(1)(f)). |
| Selected plan, billing references, payment status and required invoice information | Provide paid access and handle payments/refunds: contract; accounting and tax obligations: legal obligation (6(1)(c)). Stripe processes payment details under its own roles and notice. |
| Coaching contact name/email, venue, requested dates, session goals, quote and appointment status | Respond to a request, agree a quote and deliver a session: pre-contract steps and contract. We do not use the supplied email for marketing. |
| Withdrawal statements, correspondence and complaint records | Comply with consumer/data-protection obligations; resolve enquiries and establish or defend claims: legal obligation and legitimate interests. |
| Player/profile details, authorised profile photos, shirt numbers, observations and derived match/season insights | Deliver the analysis requested by the organisation under its instructions and sharing permissions. The organisation must establish its own lawful basis and inform participants. Personal-account features are supplied under the user’s contract. |
| Security/session information, request metadata, coarse editing activity and a keyed digest used for abuse limits | Protect the service, diagnose problems and prevent misuse: legitimate interests. Necessary device storage supports requested functions. Optional YouTube loading requires your consent (6(1)(a) where relevant). |
| Club invitation email, accepted assignment grants and optional per-club screen-name permission | Arrange limited analysis collaboration and repeat assignments: contract and legitimate interests in administering requested work. Optional screen-name display requires your separate per-club permission; withdraw it under Account settings without changing Player profile sharing. |
| Normalized recurring-revenue facts, aggregate footage coverage and successful editing account-minutes | Understand service use and subscriptions: legitimate interests in operating and improving the service. Owner dashboards show operational aggregates, not private player profiles, footage or analysis notes. Editing minutes are coarse activity, not working time. |
Our legitimate interests are reliable service delivery, preventing unauthorised access and resolving disputes. We limit data and access for those purposes; you may object. Required form fields identify what is needed to respond or provide the requested service. Optional goals, photos and optional media choices can be left out. Without necessary contact, sign-in or billing details we may be unable to fulfil that request.
Sources and visibility
We receive data from you, your organisation’s authorised users, invited contributors, Auth0 and payment-status messages from Stripe. An organisation may enter observations about players or opposing teams who have no account. It must provide the relevant notice, including for minors, and use only necessary information. Access follows local membership, role and sharing permissions. A public coaching calendar shows occupied time without client names, contacts or quotes. Only the website owner can manage coaching enquiries and withdrawal statements.
Match and player insights are derived coaching aids. They are not automated decisions with legal or similarly significant effects. We do not sell personal data or run advertising profiles. Do not enter health, injury, identity-document or other sensitive information in ordinary notes. Clubs must assess safeguarding, parental authority and any additional legal basis before processing children’s or sensitive data; a paid seat or invitation is not parental consent.
Suppliers and transfers
The service uses Google Cloud for hosting, database, private photos and operational logs; Auth0/Okta for authentication; Stripe for payments; Resend for service email; and Cloudflare for domain/DNS and email forwarding. Authorised advisers or authorities may receive information when necessary for a legal obligation or a specific matter. Supplier access is limited to the relevant service. Provider-controlled payment and authentication activities may also be covered by their own notices.
The staging application and database are hosted in the Netherlands (Google Cloud europe-west4). This does not mean every supplier or support operation is confined to the EEA. Suppliers may process information in other countries, including the United States. Before production, the relevant processing contracts, actual subprocessors and transfer mechanisms must be verified. Where required, transfers must use an applicable adequacy decision or safeguards such as EU standard contractual clauses with the necessary assessment and supplementary measures. Ask us for the applicable recipient and safeguard information or a copy of the safeguards. We do not claim that every supplier is EU-only.
YouTube is contacted only after your media choice permits it. Google Maps links contact Google when you open them. Those providers receive information such as your IP address and the requested video or venue under their own policies. Read our cookie and external-media notice.
Retention and deletion
- Account and analysis records: while needed for the account, organisational service or another lawful purpose. Once the last relevant membership or subscription ends, and no active product, authorised collaboration or other lawful purpose requires retention, the intended maximum for inactive analysis data is twelve months. Data no longer needed will be deleted or irreversibly anonymised from active systems by the end of that period, subject to legally justified exceptions; residual backups follow their limited retention schedule. Earlier erasure rights and necessity limits still apply. Cancellation does not itself request account deletion or erase another party’s independently held shared information. See section 8 of the general terms. Validation of this inactive-data policy is required before production.
- Coaching requests: routine maintenance removes them ninety days after the later of the session end and the owner’s last update. Separately retained invoices and agreed correspondence follow their applicable purpose and legal retention period.
- Withdrawal statements: while unresolved, then two years after handling in the application. Required accounting/refund records may be retained separately for the statutory period. A specific dispute or legal hold can require longer retention of the relevant evidence.
- Expired/terminal assignment notifications: ninety days under the service’s cleanup policy. Individual coarse editing records: thirty days through maintenance. Aggregate daily workspace totals may remain for operational trends and can still relate to a Solo owner; the account/analysis necessity and retention criteria above apply. Active-contributor counts are limited to the last thirty days. Accepted contributor contacts remain for requested collaboration and repeat assignments until no longer necessary or erased; assignment access can be revoked without deleting the club’s analysis. Legacy revoked grants are not automatically restored. Short-lived invitation/sign-in links expire under their own access limits.
- Dutch tax and accounting records: generally seven years where the tax retention obligation applies; only information needed for that obligation is retained.
- Operational logs and backups: used for incident diagnosis, security and recovery. Staging database automated backups rotate over seven days. Provider logs and isolated incident evidence follow their configured retention and necessary investigation period. Exact production log, photo-recovery and backup periods require approval before production; deletion must be reapplied if a backup is restored.
We review retained support correspondence when a matter closes and remove information no longer needed, subject to the relevant claim or statutory record-keeping period. You can ask about the period or criteria applying to your specific record.
Your rights and how to use them
Email the contact above to request access, correction, erasure, restriction or portability, or object to processing based on legitimate interests. These rights have statutory conditions and exceptions. You can withdraw optional-media consent through “Media privacy choices”; withdrawing consent does not affect earlier lawful processing. Changing a profile-sharing choice is separate from accepting these terms.
We respond without undue delay and normally within one month. If a permitted extension is needed because of complexity or number of requests, we explain it within that first month. We may ask for proportionate information to verify identity; do not send an identity document unless we explain why it is necessary and how to minimise it. Contacting us is free, subject only to the limited exceptions allowed by law. For organisation-controlled data, we coordinate with its controller.
You may complain to the Autoriteit Persoonsgegevens or the supervisory authority in your country of residence, work or the alleged infringement, and seek a judicial remedy. You do not have to complete our complaints process first.
Security and updates
We use access restrictions, encrypted transport, secure sessions and controlled operational access. Local video is selected in your browser and is not uploaded to InForm Rugby. No system can eliminate all risk; report suspected unauthorised access promptly. Material notice changes are dated and communicated where required. This notice does not expand who can access your records.